What is it?
This tool checks a password against the Have I Been Pwned database of hundreds of millions of leaked passwords, without revealing it. Your browser turns the password into a SHA-1 hash, sends only the first 5 of its 40 characters, receives every leaked hash that starts the same way, and looks for a match on your own device. Attackers try leaked passwords first on every site, so a leaked password is unsafe however strong it looks.
Who is it for?
Anyone who reuses passwords, people who received a “suspicious sign-in” alert, and families or small offices tidying up their accounts.
How to use it
- Type the password in Password. Show reveals it.
- Press Check for leaks. The tool shows the hash prefix it sent and how many leaked hashes start with it.
- Read the result, and if it was leaked, change it everywhere you use it.
Worked example
Tap Try a sample to check password123. Its SHA-1 hash starts with CBFDA; only those 5 characters are sent, and the answer shows it has leaked millions of times. Hundreds of different passwords share any 5-character prefix and padding is added, so nobody, not even the database, can tell which password you checked.
Have I Been Pwned is a free public service by security researcher Troy Hunt. A password manager can check all your saved passwords automatically.
Errors and how to fix them
- “⚠️ Leaked! This password appears … times in known data breaches”: change it on every account that uses it, starting with email and banking, and turn on two-step verification.
- “✓ Good news: this password is not in any known breach”: good, but it can still be weak; check it with the Password Strength Checker too.
- “Type a password first”
- “Could not reach the leak database. Check your connection” or “The leak database answered … Try again in a minute”
- “This browser cannot make the secure hash here. Open the page over https”: use the normal https address of the site.
Open the tool: Was My Password Leaked?
Still stuck?
Contact support. Tell us which tool or page you were using, what you tapped, what you saw, and your phone or computer and browser (for example: Android phone, Chrome). We reply by email.
Questions, or an error not listed here?
Tell us in the comments: what you were doing, the exact message you saw, and your device and browser. We read every comment and add new fixes to this article.